WARNING: Version 6.2 of Beats has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Namespacing
editNamespacing
editAll settings are structured using dictionaries and lists. Those are collapsed into "namespaced" settings, by creating a setting using the full path of the settings name and it’s parent structures names, when reading the configuration file.
For example this setting:
output: elasticsearch: index: 'beat-%{[beat.version]}-%{+yyyy.MM.dd}'
gets collapsed into output.elasticsearch.index: 'beat-%{[beat.version]}-%{+yyyy.MM.dd}'
. The
full name of a setting is based on all parent structures involved.
Lists create numeric names starting with 0.
For example this filebeat setting:
filebeat: prospectors: - type: log
Gets collapsed into filebeat.prospectors.0.type: log
.
Alternatively to using indentation, setting names can be used in collapsed form too.
Note: having two settings with same fully collapsed path is invalid.
Simple filebeat example with partially collapsed setting names and use of compact form:
filebeat.prospectors: - type: log paths: ["/var/log/*.log"] multiline.pattern: '^[' multiline.match: after output.elasticsearch.hosts: ["http://localhost:9200"]